Customizable encryption algorithm based on a sponge construction with authenticated and non-authenticated modes of operation

BACKGROUND

1. Statement of the Technical Field

The inventive arrangements relate to cryptographic systems. More particularly, the inventive arrangements concern cryptographic systems implementing a customizable encryption algorithm based on a sponge construction with authenticated and non-authenticated modes of operation.

2. Description of the Related Art

Sponge functions may be used in cryptographic applications. In this regard, the sponge functions can be used to implement symmetric cryptography functionalities (e.g., key derivation, message encryption, and authentication code computation). A detailed discussion of sponge functions is provided in a document entitled “Cryptographic Sponge Functions”, which was written by Bertoni et al. and published on Jan. 14, 2011 (“Bertoni”). As stated in Bertoni, a sponge function instantiates a sponge construction. The sponge construction is a simple iterated construction for building a function F based on a fixed length permutation. The function F has a variable-length input and an arbitrary output length. The fixed length permutation operates on a state of b=r+c bits, where r is the bitrate and c is the capacity. The capacity c determines the security level of the sponge construction.

During operation, each of the bits b is initialized to zero and an input message is cut into blocks of r bits. Thereafter, absorbing operations are performed in which: the r bits of each block are respectively XORed with the first r initialized bits; and a first permutation operation is performed using the results of the XOR operation as inputs. Next, squeezing operations are performed in which a second permutation operation is performed using the output bits of the first permutation operation as input bits. The output of the second permutation operation may then be truncated to the first l bits.

Duplex constructions are closely related to the sponge construction. Duplex constructions comprise a plurality of duplexing stages. During a first duplexing stage, all bits of the state are set to zero and a first input string τ₀is padded. The first input string τ₀is then XORed with the first r initialized bits. Then, a permutation function is applied to the results of the XOR operations so as to generate a set of first output bits. The first output bits are then truncated to the first l bits. In a next duplexing stage, a second input string τ₁is padded. The second input string τ₁is then XORed with the first output bits of the first duplexing stage. The permutation function is applied to the results of the XOR operations so as to generate a set of second output bits. The second output bits are then truncated to the first l bits.

SUMMARY OF THE INVENTION

The invention concerns implementing systems and methods for generating encrypted data (e.g., ciphertext). The methods involve: combining a cryptographic key with state initialization bits to generate first combination bits; producing a first keystream by performing a permutation function ƒ using the first combination bits as inputs thereto; and using the first keystream to encrypt first data (e.g., authentication data or message body data) so as to produce first encrypted data (e.g., via modular arithmetic). The permutation function ƒ comprises a round function ƒ_roundthat is iterated R times. The round function ƒ_roundconsists of (1) a substitution layer in which the first combination bits are substituted with substitute bits, (2) a permutation layer in which the substitute bits are re-arranged, (3) a mixing layer in which at least two outputs of the permutation layer are combined together, and (4) an addition layer in which a constant is added to the output of the mixing layer.

The cryptographic key may be concatenated with a flag value prior to being combined with the state initialization bits. The first keystream may be truncated to a desired length prior to being used to encrypt the first data. The first data may be padded to make a total number of bits contained therein a multiple of the total number of state initialization bits prior to being encrypted. A multi-bit value for the state initialization bits may be selected that is unique for a given application.

In some scenarios, the present invention is implemented in a sponge framework. Accordingly, the method may additionally comprise: producing a second keystream by performing the permutation function ƒ using the first keystream as inputs thereto; and using the second keystream to encrypt second data (e.g., other message data) so as to produce second encrypted data.

In other scenarios, the present invention is implemented in a duplex framework. Accordingly, the first encrypted data is produced by: combining the first keystream with authentication data to generate the second combination bits; producing a second keystream by performing the permutation function ƒ using the second combination bits as inputs thereto; and combining the second keystream with the message body data so as to produce the first encrypted data. An authentication tag is generated by: combining the second keystream with the message body data to produce the third combination bits; producing a third keystream by performing the permutation function ƒ using the third combination bits as inputs thereto; and using at least a portion of the third keystream as the authentication tag.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments will be described with reference to the following drawing figures, in which like numerals represent like items throughout the figures, and in which:

<figref idref="DRAWINGS">FIG. 1</figref> is a schematic illustration of an exemplary sponge construction employing a unique permutation function.

<figref idref="DRAWINGS">FIG. 2</figref> is a schematic illustration of an exemplary duplex construction employing a unique permutation function.

<figref idref="DRAWINGS">FIG. 3</figref> is a schematic illustration that is useful for understanding the unique permutation function ƒ of the present invention.

<figref idref="DRAWINGS">FIG. 4</figref> is an expanded bock diagram of the round function ƒ_roundshown in <figref idref="DRAWINGS">FIG. 3</figref>.

<figref idref="DRAWINGS">FIG. 5</figref> is a schematic illustration of an exemplary hardware implementation of a mixer.

<figref idref="DRAWINGS">FIG. 6</figref> is a flow diagram of an exemplary method for generating encrypted data that is useful for understanding the present invention.

DETAILED DESCRIPTION

It will be readily understood that the components of the embodiments as generally described herein and illustrated in the appended figures could be arranged and designed in a wide variety of different configurations. Thus, the following more detailed description of various embodiments, as represented in the figures, is not intended to limit the scope of the present disclosure, but is merely representative of various embodiments. While the various aspects of the embodiments are presented in drawings, the drawings are not necessarily drawn to scale unless specifically indicated.

The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by this detailed description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.

Reference throughout this specification to features, advantages, or similar language does not imply that all of the features and advantages that may be realized with the present invention should be or are in any single embodiment of the invention. Rather, language referring to the features and advantages is understood to mean that a specific feature, advantage, or characteristic described in connection with an embodiment is included in at least one embodiment of the present invention. Thus, discussions of the features and advantages, and similar language, throughout the specification may, but do not necessarily, refer to the same embodiment.

Furthermore, the described features, advantages and characteristics of the invention may be combined in any suitable manner in one or more embodiments. One skilled in the relevant art will recognize, in light of the description herein, that the invention can be practiced without one or more of the specific features or advantages of a particular embodiment. In other instances, additional features and advantages may be recognized in certain embodiments that may not be present in all embodiments of the invention.

Reference throughout this specification to “one embodiment”, “an embodiment”, or similar language means that a particular feature, structure, or characteristic described in connection with the indicated embodiment is included in at least one embodiment of the present invention. Thus, the phrases “in one embodiment”, “in an embodiment”, and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment.

As used in this document, the singular form “a”, “an”, and “the” include plural references unless the context clearly dictates otherwise. Unless defined otherwise, all technical and scientific terms used herein have the same meanings as commonly understood by one of ordinary skill in the art. As used in this document, the term “comprising” means “including, but not limited to”.

Sponge and duplex constructions provide frameworks representing new cryptographic paradigms with many advantages including processing performance and provable computational cryptographic strength. A novel cryptographic algorithm design is described herein that is based on the sponge and duplex construction frameworks. More particularly, the novel cryptographic algorithm comprises a unique permutation function ƒ that is used with a sponge construction and/or a duplex construction. In this regard, the present invention provides the same advantages of conventional sponge and duplex constructions, as well as other additional advantages. These other additional advantages include, but are not limited to: the provision of a highly configurable and customizable cryptographic algorithm; the provision of a symmetric key algorithm that is designed against a military threat model; the provision of increased throughput suitable to support high-rate networked waveforms; and the provision of an algorithm that can be used with key lengths that are longer than the key lengths which can be used with conventional cryptographic algorithms. Longer key lengths result in a higher level of security.

Referring now to <figref idref="DRAWINGS">FIG. 1</figref>, there is provided a schematic illustration of an exemplary architecture for a sponge construction <b>100</b> implementing the present invention. Notably, the sponge construction <b>100</b> uses a unique permutation function ƒ (described below) to provide the traditional suite of cryptographic modes. This will become more evident as the discussion progresses.

As shown in <figref idref="DRAWINGS">FIG. 1</figref>, the sponge construction <b>100</b> is generally designed to implement symmetric cryptography functionalities, namely key derivation and message encryption. The sponge construction <b>100</b> is a simple iterated construction for building a function F based on a unique permutation function ƒ. The function F has a variable-length input and an arbitrary output length. The unique permutation function ƒ operates on a state of b=r+c bits, where r (e.g., 128 bits) is the bitrate and c (e.g., 384 bits) is the capacity. The capacity c determines the security level of the sponge construction.

Notably, the sponge construction <b>100</b> can be implemented in hardware, software or a combination of both hardware and software. As such, the operations of each functional block <b>102</b>-<b>106</b> may be implemented using hardware and/or software. The hardware can include, but is not limited to an electronic circuit. The electronic circuit can include passive components, active components and logical components.

The sponge construction <b>100</b> is divided into two phases. The first phase is an absorbing phase <b>120</b> in which the cryptographic key K or K∥N (i.e., a concatenation of the cryptographic key K and a flag N) is absorbed into a state of the sponge construction <b>100</b> while interleaving with applications of the underlying permutation function ƒ. Such absorption is achieved by combining K (or K∥N) with the first r bits of the initialized state bits b. In some scenarios, the bits b (e.g., 512 bits) are initialized to zero. The present invention is not limited in this regard. The bits b (e.g., 512 bits) may alternatively be initialized to any bit value (e.g., any 512 bit value). As such, each user could generate its own unique value to set during the initialization phase.

The combining of K (or K∥N) with the first r bits of the initialized state can be achieved via exclusive OR (“XOR”) operations <b>110</b>, as shown in <figref idref="DRAWINGS">FIG. 1</figref>. XOR operations are well known in the art, and therefore will not be described in detail here. Still, it should be understood that the XOR operations are performed on a bit-by-bit basis. The result of each XOR operation is true whenever an odd number of inputs are true and false whenever an even number of inputs are true. The results of the XOR operations are then passed to permutation functional block <b>102</b> where the results are interleaved with applications of the unique permutation function ƒ.

The second phase is a squeezing phase <b>122</b> in which keystream blocks Z₀, Z₁, Z₂are produced by the performance of the unique permutation function ƒ in permutation functional blocks <b>102</b>-<b>106</b>. Each keystream block Z₀, Z₁, Z₂comprises r bits. The unique permutation function ƒ will be described in detail below. Still, it should be understood that the permutation function ƒ maps each possible value of the bits input thereto into a particular unique value of the output bits. Notably, permutation functional block <b>102</b> takes the output of the absorbing phase <b>120</b> as an input. Permutation functional block <b>104</b> takes the output of permutation functional block <b>102</b> as an input. Permutation functional block <b>106</b> takes the output of permutation functional block <b>104</b> as an input.

Next, the keystream blocks Z₀, Z₁, Z₂are used to encrypt a message M. In this regard, the keystream blocks Z₀, Z₁, Z₂can be truncated to a desired length l. Additionally or alternatively, the message M may be padded to make it a multiple of r (if it is not a multiple of r). The message M is parsed into a plurality of message blocks M₀, M₁, M₂. Each message block M₀, M₁, M₂comprises a plurality of bits of the message M. Each keystream block is then combined with a respective message block so as to produce an encrypted data block. The encrypted data block can include, but is not limited to, a ciphertext block C₀, C₁or C₂. The present invention is described herein in relation to ciphertext. The present invention is not limited in this regard. The present invention can be used to encrypt any type of data (e.g., text, audio, video, etc. . . . ).

In some scenarios, the combining of the keystream and message blocks is achieved using modular arithmetic. For example, each keystream block Z₀, Z₁, Z₂is combined with a respective block of message bits M₀, M₁, M₂via modulo 2 addition. The modulo 2 addition can be implemented using an XOR operation, as shown in <figref idref="DRAWINGS">FIG. 1</figref>. The XOR operation is performed on a bit-by-bit basis. As such, a first bit m₀of a message block M₀, M₁or M₂is combined with a first bit z₀of a respective keystream block Z₀, Z₁or Z₂via modulo 2 addition. Next, a second bit m₁of a message block M₀, M₁or M₂is combined with a first bit z₁of a respective keystream block Z₀, Z₁or Z₂via modulo 2 addition, and so on.

Referring now to <figref idref="DRAWINGS">FIG. 2</figref>, there is provided a schematic illustration of an exemplary architecture for a duplex construction <b>200</b> implementing the present invention. The duplex construction <b>200</b> is an adaptation of the sponge construction framework that, together with the unique permutation function ƒ (described below), provides an additional Authenticated Encryption (“AE”) cryptographic mode. This mode allows both source and integrity verification of encrypted traffic. This will become more evident as the discussion progresses.

Notably, the duplex construction <b>200</b> can be implemented in hardware, software or a combination of both hardware and software. As such, the operations of each component <b>202</b>-<b>232</b> may be implemented using hardware and/or software. The hardware can include, but is not limited to an electronic circuit. The electronic circuit can include passive components, active components and logical components.

In the duplex construction <b>200</b>, the absorbing phase and squeezing phase are combined into each of a plurality of duplex operations. Accordingly, the duplex construction <b>200</b> comprises a plurality of duplex objects <b>202</b>-<b>206</b>. The operations of each duplex object will be described separately below. Notably, the state of each duplex object call is preserved.

The input to duplex object <b>202</b> is a cryptographic key K (or optionally K∥1, i.e. a concatenation of the cryptographic key K and a flag 1). The cryptographic key K (or optionally K∥1) is padded in padding functional block <b>214</b> to make it a multiple of r (if it is not a multiple of r). The padding can involve appending bits to the beginning or end of the cryptographic key K (or optionally K∥1). Next, the output of padding functional block <b>214</b> is then combined with the first r bits of the initialized state bits b. In some scenarios, the bits b are initialized to zero, where b=r+c. The present invention is not limited in this regard. The bits b (e.g., 512 bits) may alternatively be initialized to any bit value (e.g., a 512 bit value). As such, each user could generate its own unique value to set during the initialization phase.

The combining of the padding functional block output and the first r bits of the initialized state can be achieved via XOR operations <b>110</b>, as shown in <figref idref="DRAWINGS">FIG. 1</figref>. XOR operations are well known in the art, and therefore will not be described in detail here. Still, it should be understood that the XOR operations are performed on a bit-by-bit basis. The results of the XOR operations are then passed to permutation functional block <b>208</b>. In permutation functional block <b>208</b>, the unique permutation function ƒ is performed using the results of the XOR operations as inputs so as to generate a keystream block Z₀. The keystream block Z₀is then truncated to a desired length l, as shown by truncate functional block <b>220</b>. The value of l here can be less than r.

The input to duplex object <b>204</b> is authentication data A (or optionally A∥0, i.e. a concatenation of authentication data A and a flag 0). The authentication data A can include but is not limited to, authenticated packet headers. The authentication data A (or optionally A∥0) is padded in padding functional block <b>216</b> to make it a multiple of r (if it is not a multiple of r). The padding of padding functional block <b>216</b> is the same as or similar to that of padding functional block <b>214</b>. Next, the output of padding functional block <b>216</b> is then combined with keystream block Z₀. This combining can be achieved via XOR operations <b>228</b>, as shown in <figref idref="DRAWINGS">FIG. 2</figref>. XOR operations are well known in the art, and therefore will not be described in detail here. Still, it should be understood that the XOR operations are performed on a bit-by-bit basis. The results of the XOR operations are then passed to permutation functional block <b>210</b>. In permutation functional block <b>210</b>, the unique permutation function ƒ is performed so as to generate a keystream block Z₁. The keystream block Z₁is then optionally truncated to a desired length l, as shown by truncate functional block <b>222</b>. The value of l here can be less than r. Truncation may be performed when the number of bits contained in the message body B is less than r. In this case, the value of l equals the number of bits contained in the message body B. The truncated keystream block Z_1-Truncis output from duplex object <b>204</b>.

Thereafter, the truncated keystream block Z_1-Truncis combined with a message body B (or optionally B∥1, i.e. a concatenation of message body B and a flag 1). The message body B can include, but is not limited to, packet payload. This combining is achieved via XOR operations <b>232</b>, which produces encrypted data (e.g., ciphertext) C. The XOR operations <b>232</b> are performed on a bit-by-bit basis.

The input to duplex object <b>206</b> is message body data B (or optionally B∥1). The message body data B can include but is not limited to, packet payload data. The message body data B (or optionally B∥1) is padded in padding functional block <b>218</b> to make it a multiple of r (if it is not a multiple of r). The padding of padding functional block <b>218</b> is the same as or similar to that of padding functional blocks <b>214</b> and <b>216</b>. Next, the output of padding functional block <b>218</b> is then combined with keystream block Z₁. This combining can be achieved via XOR operations <b>230</b>, as shown in <figref idref="DRAWINGS">FIG. 2</figref>. XOR operations are well known in the art, and therefore will not be described in detail here. Still, it should be understood that the XOR operations are performed on a bit-by-bit basis. The results of the XOR operations are then passed to permutation functional block <b>212</b>. In permutation functional block <b>212</b>, the unique permutation function ƒ is performed so as to generate a keystream block Z₂. The keystream block Z₂is then optionally truncated to a desired length l, as shown by truncate functional block <b>224</b>. The value of here can be less than r. The truncated keystream block Z_2-Truncis output from duplex object <b>204</b>. The truncated keystream block Z_2-Truncis then used as an authentication tag T.

In a communications scenario, the encrypted data (e.g., ciphertext) C and the authentication tag T would be transmitted from a source communication device to a destination communication device. The cryptographic key K would not be transmitted since it would be known by both devices.

The advantages of the duplex construction <b>200</b> are that: a single cryptographic key is required; encryption and authentication requires only a single pass; intermediate tags are supported thereby; additional authentication data (e.g., packet headers) is supported thereby; it is secure against generic attacks; and the ability to trade off speed and security by adjusting the value of r.

Referring now to <figref idref="DRAWINGS">FIG. 3</figref>, there is provided a schematic illustration that is useful for understanding the unique permutation function ƒ of the present invention which is employed in the sponge and duplex constructions described above in relation to <figref idref="DRAWINGS">FIGS. 1-2</figref>. The permutation function ƒ supports any key size (e.g., 128 bits or 256 bits) and is bijective. Since the permutation function ƒ is bijective, ƒ−⁻¹(inverse of ƒ) exists by definition. While ƒ¹is not used in practice, it may be helpful for crypto-analysis and verification purposes. Notably, the number of bits that are input and/or output from the permutation function ƒ is also customizable.

The permutation function ƒ comprises a round function ƒ_roundthat is iterated R times, depending on the key size. The round function ƒ_roundconsists of the following layers: a substitution layer <b>302</b>; a permutation layer <b>304</b>; a mixing layer <b>306</b>; and a round constant addition layer <b>308</b>. In the substitution layer <b>302</b>, the bits input thereto are substituted with first substitute bits in accordance with a particular transformation and/or mapping algorithm. For example, input bits <b>010001</b> are substituted with bits <b>1010</b>. The number of bits input/output to/from the substitution layer <b>302</b> can be the same or different. In the permutation layer <b>304</b>, the bits input thereto are re-arranged. In the mixing layer <b>306</b>, at least two outputs of the permutation layer are combined together. In the round constant addition layer <b>308</b>, a constant is added to the output of the mixing layer. The manners in which the operations of each layer <b>302</b>-<b>308</b> are achieved will be discussed in detail below.

Notably, R is an integer which has a value large enough to resist differential attacks, linear attacks and other attacks depending on the cryptographic key size (e.g., R=10 for a 128 bit key or R=16 for a 256 bit key). In this regard, R is a customizable element of the permutation function ƒ. In some scenarios, R is determined by (1) calculating the number of rounds needed for linear and differential crypto-analysis and (2) adding some buffer to increase the security margin.

Referring now to <figref idref="DRAWINGS">FIG. 4</figref>, there is provided an expanded block diagram of the round function ƒ_round. The substitution layer <b>302</b> comprises a plurality of identical substitution boxes (or S-boxes) <b>402</b>₁, <b>402</b>₂, <b>402</b>₃, <b>402</b>₄, . . . , <b>402</b>₃₁, <b>402</b>₃₂which collectively receive N input bits (e.g., 512 input bits) and individually receive X bits of the N input bits (e.g., 16 bits of 512 input bits). The value of N is selected to be large enough to keep a cryptographic key secure. For example, the value of N is selected to be 512 bits for a cryptographic key having a size of 128 bits or 256 bits.

The purpose of the S-boxes is to perform substitution so as to obscure the relationship between the cryptographic key and encrypted data (e.g., ciphertext). S-boxes are well known in the art, and therefore will not be described in detail herein. Any known or to be known S-box can be used herein without limitation provided that the following properties are satisfied thereby. <ul id="ul0001" list-style="none"><li id="ul0001-0001" num="0048">(1) The S-boxes have small differential probabilities.</li><li id="ul0001-0002" num="0049">(2) The S-boxes have small linear approximation biases.</li><li id="ul0001-0003" num="0050">(3) The S-boxes have a customizable number of input bits X.</li><li id="ul0001-0004" num="0051">(4) The S-boxes have customizable mapping functions.</li><li id="ul0001-0005" num="0052">For example, each S-box <b>402</b>₁, <b>402</b>₂, <b>402</b>₃, <b>402</b>₄, . . . , <b>402</b>₃₁, <b>402</b>₃₂comprises an X-bit-to-X-bit S-box or an X-bit-by-Y-bit S-box, where X is a customizable integer and Y is a customizable integer different from X. The S-boxes can be implemented as look-up tables or in hardware using logical gates (e.g., XOR gates and AND gates). The look-up tables can be fixed or dynamically generated using the cryptographic key.</li></ul>

In some scenarios, each S-box comprises a bijective 16-bit-to-16-bit S-box. An exemplary architecture for such an S-box is described in Appendix C of a document entitled “Large Substitution Boxes with Efficient Combinational Implementations” which was written by Wood and published in August 2013. This S-box is based on a multiplicative inversion in GF(2¹⁶)/&lt;p(x)&gt;, where p(x)=x¹⁶+x⁵+x³+x+1. An input to the S-box is represented as a 16-bit column vector x=(x₁₅x₁₄. . . x₁x₀)^T, x₁₅is the most significant bit. Using this notation, the forward S-box function is defined by the following mathematical equation.

<maths id="MATH-US-00001" num="00001"><math overflow="scroll"><mrow><mi>Y</mi><mo>=</mo><mrow><mrow><mi>S</mi><mo>⁡</mo><mrow><mo>(</mo><mi>X</mi><mo>)</mo></mrow></mrow><mo>=</mo><mrow><mo>[</mo><mrow><mrow><mrow><mo>(</mo><mtable><mtr><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr></mtable><mo>)</mo></mrow><mo>⁢</mo><msup><mrow><mo>(</mo><mtable><mtr><mtd><msub><mi>x</mi><mn>15</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>14</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>13</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>12</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>11</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>10</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>9</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>8</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>7</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>6</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>5</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>4</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>3</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>2</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>1</mn></msub></mtd></mtr><mtr><mtd><msub><mi>x</mi><mn>0</mn></msub></mtd></mtr></mtable><mo>)</mo></mrow><mrow><mo>-</mo><mn>1</mn></mrow></msup></mrow><mo>⊕</mo><mrow><mo>(</mo><mtable><mtr><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd></mtr></mtable><mo>)</mo></mrow></mrow><mo>]</mo></mrow></mrow></mrow></math></maths><img file="US9438416B2_D0001.tif" /><br /> The inverse of the S-box function is defined by the following mathematical equation.

<maths id="MATH-US-00002" num="00002"><math overflow="scroll"><mrow><mi>X</mi><mo>=</mo><mrow><mrow><msup><mi>S</mi><mrow><mo>-</mo><mn>1</mn></mrow></msup><mo>⁡</mo><mrow><mo>(</mo><mi>Y</mi><mo>)</mo></mrow></mrow><mo>=</mo><msup><mrow><mo>[</mo><mrow><mrow><mo>(</mo><mtable><mtr><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>1</mn></mtd></mtr><mtr><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>0</mn></mtd><mtd><mn>1</mn></mtd></mtr></mtable><mo>)</mo></mrow><mo>⁢</mo><mrow><mo>(</mo><mtable><mtr><mtd><msub><mi>y</mi><mn>15</mn></msub></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>14</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><msub><mi>y</mi><mn>13</mn></msub></mtd></mtr><mtr><mtd><msub><mi>y</mi><mn>12</mn></msub></mtd></mtr><mtr><mtd><msub><mi>y</mi><mn>11</mn></msub></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>10</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><msub><mi>y</mi><mn>9</mn></msub></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>8</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>7</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><msub><mi>y</mi><mn>6</mn></msub></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>5</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>4</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><msub><mi>y</mi><mn>3</mn></msub></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>2</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>1</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr><mtr><mtd><mrow><msub><mi>y</mi><mn>0</mn></msub><mo>⊕</mo><mn>1</mn></mrow></mtd></mtr></mtable><mo>)</mo></mrow></mrow><mo>]</mo></mrow><mrow><mo>-</mo><mn>1</mn></mrow></msup></mrow></mrow></math></maths><img file="US9438416B2_D0002.tif" /><br /> The above-described S-box can be implemented in hardware using 1238 XOR gates and 144 AND gates.

The permutation layer <b>304</b> comprises a bitwise permutation function <b>404</b>. The purpose of the bitwise permutation function <b>404</b> is to permute or change a bit position of each bit <b>410</b>₁, <b>410</b>₂, <b>410</b>₃, <b>410</b>₄, . . . , <b>410</b>₃₁, <b>410</b>₃₂input thereto relative to all other bits input thereto. Bitwise permutation functions are well known in the art, and therefore will not be described in detail herein. Any known or to be known bitwise permutation function can be used herein without limitation provided that the following properties are satisfied thereby. <ul id="ul0002" list-style="none"><li id="ul0002-0001" num="0057">(1) Each bit <b>410</b>₁, <b>410</b>₂, <b>410</b>₃, <b>410</b>₄, . . . , <b>410</b>₃₁, <b>410</b>₃₂permutes to an output bit position different from its input bit position.</li><li id="ul0002-0002" num="0058">(2) All outputs of a given S-box go to X different mixers.</li><li id="ul0002-0003" num="0059">(3) The permutation period of the permutation function ƒ exceeds the number of rounds R.</li><li id="ul0002-0004" num="0060">For example, the bitwise permutation function includes a linear permutation function, an affine permutation function, or a random permutation function.</li></ul>

In some scenarios, the bitwise permutation function <b>404</b> comprises an affine function defined by the following mathematical equation. <br />π(<i>x</i>)=<i>ax</i>+β(mod 512)<br /> where π(x) represents the output bit position, a is an integer constant (e.g., 31), x represents the input bit position and β is an integer constant (e.g., 15).

The mixing layer <b>306</b> comprises a mixing function that is implemented via a plurality of mixers <b>406</b>₁, <b>406</b>₂, . . . , <b>406</b>₁₆. In the scenario shown in <figref idref="DRAWINGS">FIG. 4</figref>, one mixer is provided for every two S-boxes. The present invention is not limited in this regard. The particular number of S-boxes per mixer is customizable. Also, the mixing function is a customizable element of the present invention. The purpose of the mixing function is to provide local diffusion (i.e., across two words) and increase the linear and differential branch numbers of a round from two to three. In this regard, mixers based on matrix multiplication in Galois Field GF(2^M) may be employed because they satisfy all of the following constraints: the matrix is invertible in GF(2¹⁶)/&lt;p(x)&gt;; the matrix has a differential and linear branch number equal to three; and the transformation is efficiently implementable in hardware.

In some scenarios, operations performed by each mixer <b>406</b>₁, <b>406</b>₂, ..., <b>406</b>₁₆is defined by the following mathematical equation. <br /><i>p</i>(<i>x</i>) <i>=x</i>¹⁶<i>+x</i>⁵<i>+x</i>³<i>+x</i>²+l The mixer takes in two words W₁and W₂as input and produces outputs W′₁and W′₂as follows.

<maths id="MATH-US-00003" num="00003"><math overflow="scroll"><mrow><mrow><mo>(</mo><mtable><mtr><mtd><msubsup><mi>W</mi><mn>1</mn><mi>′</mi></msubsup></mtd></mtr><mtr><mtd><msubsup><mi>W</mi><mn>2</mn><mi>′</mi></msubsup></mtd></mtr></mtable><mo>)</mo></mrow><mo>=</mo><mrow><mrow><mo>(</mo><mtable><mtr><mtd><mn>1</mn></mtd><mtd><mi>x</mi></mtd></mtr><mtr><mtd><mi>x</mi></mtd><mtd><mrow><mi>x</mi><mo>+</mo><mn>1</mn></mrow></mtd></mtr></mtable><mo>)</mo></mrow><mo>⁢</mo><mrow><mo>(</mo><mtable><mtr><mtd><msub><mi>W</mi><mn>1</mn></msub></mtd></mtr><mtr><mtd><msub><mi>W</mi><mn>2</mn></msub></mtd></mtr></mtable><mo>)</mo></mrow></mrow></mrow></math></maths><img file="US9438416B2_D0003.tif" /><br /> The mixer is implementable in hardware. An exemplary hardware implementation of the mixer is provided in <figref idref="DRAWINGS">FIG. 5</figref>. As shown in <figref idref="DRAWINGS">FIG. 5</figref>, the mixer comprises XOR gates <b>502</b>, <b>506</b>, <b>510</b> and Galois field multipliers <b>504</b>, <b>508</b>. The Galois field multipliers <b>504</b>, <b>508</b> perform multiplication by x in Galois field GF(2^x).

The round constant addition layer <b>308</b> comprises a plurality of addition operations represented by blocks <b>408</b>₁, <b>408</b>₂, <b>408</b>₃, <b>408</b>₄, . . . , <b>408</b>₃₁, <b>408</b>₃₂. The purpose of the addition operations is to add a constant N bit value to the state using bitwise XOR in order to disrupt symmetry and prevent slide attacks. Notably, the round constant must be fixed random N-bit values. Each round i must use a different round constant. The round constant is customizable, and should be unique for each round to prevent against slide attacks and be random, pseudorandom or highly asymmetric to reduce symmetry in the state.

In some scenarios, the round constant RC_ifor round i is given by the following mathematical equation. <br />RC_i=SHA3−N(ASCII(<i>i</i>))<br /> where ASCII(i) is a function that provides a one or two byte ASCII representation of round i and SHA3-512 is the SHA-3 hash function that outputs an N (e.g., <b>512</b>) bit message digest. The following TABLE 1 provides the values of the round constant RC_iup to i=16.

<tables id="TABLE-US-00001" num="00001"><table frame="none" colsep="0" rowsep="0" pgwide="1"><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="1" colwidth="35pt" align="left" /><colspec colname="2" colwidth="224pt" align="left" /><thead><row><entry namest="1" nameend="2" rowsep="1">TABLE 1</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row><row><entry>Constant</entry><entry>Hex Value</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row></thead><tbody valign="top"><row><entry>RC₁</entry><entry>00197a4f5f1ff8c356a78f6921b5a6bfbf71df8dbd313fbc5095a55de756bfa1</entry></row><row><entry /><entry>ea7240695005149294f2a2e419ae251fe2f7dbb67c3bb647c2ac1be05eec7ef9</entry></row><row><entry>RC₂</entry><entry>ac3b6998ac9c5e2c7ee8330010a7b0f87ac9dee7ea547d4d8cd00ab7ad1bd5f5</entry></row><row><entry /><entry>7f80af2ba711a9eb137b4e83b503d24cd7665399a48734d47fff324fb74551e2</entry></row><row><entry>RC₃</entry><entry>ce4fd4068e56eb07a6e79d007aed4bc8257e10827c74ee422d82a29b2ce8cb07</entry></row><row><entry /><entry>9fead81d9df0513bb577f3b6c47843b17c964e7ff8f4198f32027533eaf5bcc1</entry></row><row><entry>RC₄</entry><entry>5058cb975975ceff027d1326488912e199b79b916ad90a3fe2fd01508cd7d7c0</entry></row><row><entry /><entry>1bc8aaa4d21a8473fb15f3b151ab9e44172e9ccb70a5ea04495af3ec03b5153e</entry></row><row><entry>RC₅</entry><entry>84da272d13a44f0898ee4ea53334c255d894cc54d357c55466d760debde482a2</entry></row><row><entry /><entry>44c128df641e80673a8bc34a1620d880b7965e549f313ddccfd506b073413b87</entry></row><row><entry>RC₆</entry><entry>bb93aaa23b38ea96c9346ef91e184982bf50e91033f4354ecb20d3c7390c2b41</entry></row><row><entry /><entry>862e8825ec3d0fee0a6f978881f90728c6748e4aed8b732350075d6c2bdd8e4b</entry></row><row><entry>RC₇</entry><entry>fe32f3eba76626dedf36622bfdc5ccd33db2f3e0dd7c3c128298ea78c1cc7fee</entry></row><row><entry /><entry>1a140edb8e57cd5824c7f4b817c0fc94e70da5b9399faaf9a848a46ad30679e9</entry></row><row><entry>RC₈</entry><entry>952ba02486b818febc0ec98559df27c79357838f011b1e5bc11f2cfb6fc0573e</entry></row><row><entry /><entry>545978c2bc5b390f44907f8da0dfd68206fe4521f86ba6c879ec1e69caed9533</entry></row><row><entry>RC₉</entry><entry>b41e6bb4ed20294016399c268da6bf88c89e2dc118a361b3560ee8daed973a8f</entry></row><row><entry /><entry>9778df40e308c1206fa421f97f3fd3f63d2b4b3b57eb5bcbec6ad64d46216b692</entry></row><row><entry>RC₁₀</entry><entry>6954a418cecc43633bd526c2499dfc16b832f58b216b9a8b226a6a0b7918d364</entry></row><row><entry /><entry>a7939004339de0ba08e2b547e64dc5622e24b0c4f8f415d9e0a84cb94b6c5f3f</entry></row><row><entry>RC₁₁</entry><entry>2e4b9ad37091e3e5a218c5e57b33ed3470ba4f31fbcf16424684fdd5cde38e88</entry></row><row><entry /><entry>9eae3f018b37af58c24ccc8af57abc2c6911408dd20ef6435e4494a3e6599a06</entry></row><row><entry>RC₁₂</entry><entry>aa42aca73bd7f8a17e987f281422b266e44f0de1615d2d393e620c8c5a2c80b4</entry></row><row><entry /><entry>f06178c8455bf98179603f2f1bcb30b2559f282c799e40533b0665f97a2a706a</entry></row><row><entry>RC₁₃</entry><entry>969c39ae2dc16834310344c0579d0ffdfde01772dbf9a4cab984953c395d7791</entry></row><row><entry /><entry>1510f39e5f37295e3611a1d46101460daf731ddbdab1ec1bbc512edc44680d8d</entry></row><row><entry>RC₁₄</entry><entry>8a1e6ce31f0b526d884b584aa1a5ae4294fcf85fd2e525f959ed1a54233359c7</entry></row><row><entry /><entry>c5fece6d24775e7d4a9ad97c2632a3be5b331a8f580f557b269e7b65123a5992</entry></row><row><entry>RC₁₅</entry><entry>9bd64a932f09672def04b6a94753a3e4087a1c3895078dc70927fcd774888dfd</entry></row><row><entry /><entry>400b95fd1c6a0b2a91a1ba44eea09f5163dba4dfa9da7b8eb97d791cab566437</entry></row><row><entry>RC₁₆</entry><entry>48401f65c2d2d9e71fe47bd80b28d834eee8fff3be9aa4608cba33e6fedce0b1</entry></row><row><entry /><entry>693c80cdc36db7f504e4abea23ccc6729a030f5b3e035fb59c2c788215cf84a8</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row></tbody></tgroup></table></tables>

Notably, the present invention is suitable for implementation on Field Programmable Gate Arrays (“FPGAs”). Serial and fully parallel implementations can be used to meet area or performance constraints. The S-boxes may be implemented using composite field techniques and pipelined for higher performance. Also, the present invention can be integrated into Single Chip Crypto (“SCC”) systems.

Furthermore, the present invention anticipates future security requirements. Post Quantum Security (“PQS”) will become a requirement for radio product customers, as well as provable computational security and quantified theoretical security metrics and analysis processes. The present invention provides a security means that satisfies all of these requirements.

As evident from the above discussion, the present algorithm is highly customizable within a security margin. This customizability is useful in cases where different users want unique, proprietary algorithms. The following features of the present invention are customizable: (1) the state initialization; (2) the number of rounds R; (3) the permutation function ƒ; (4) the number of bits N input into the round function; (5) the type, number, parameters and mapping function of the S-boxes; (6) the bitwise permutation function; (7) the mixing function; and (8) the round constants.

Referring now to <figref idref="DRAWINGS">FIG. 6</figref>, there is provided a flow diagram of an exemplary method <b>600</b> for generating encrypted data (e.g., ciphertext) that is useful for understanding the present invention. Method <b>600</b> begins with step <b>602</b> and continues with optional step <b>604</b>. In optional step <b>604</b>, a cryptographic key is concatenated with a flag value. Next in step <b>606</b>, the cryptographic key is combined with state initialization bits to generate the first combination bits. A multi-bit value for the state initialization bits may be selected such that it is unique for a given application.

The first combination bits are then used to produce a first keystream, as shown by step <b>608</b>. The first keystream may optionally be truncated to a desired length, as shown by step <b>610</b>. The first keystream is produced using a permutation function ƒ. The permutation function ƒ is performed using the first combination bits as inputs thereof. The permutation function ƒ comprises a round function ƒ_roundthat is iterated R times. The round function ƒ_roundconsists of (1) a substitution layer in which the first combination bits are substituted with substitute bits, (2) a permutation layer in which the substitute bits are re-arranged, (3) a mixing layer in which at least two outputs of the permutation layer are combined together, and (4) an addition layer in which a constant is added to the output of the mixing layer.

After completing optional step <b>610</b>, method <b>600</b> continues with another optional step <b>612</b>. Step <b>612</b> involves padding the first data to make a total number of bits contained therein a multiple of the total number of state initialization bits prior to being encrypted. The first data is then encrypted using the first keystream, as shown by step <b>614</b>. In this regard, the first data may be combined with the first keystream using modular arithmetic (e.g., modulo 2 addition). The first data comprises, but is not limited to, authentication data and/or message body data.

If a sponge framework is employed [<b>616</b>: YES], then steps <b>618</b>-<b>620</b> are performed. Step <b>618</b> involves producing a second keystream by performing the permutation function ƒ using the first keystream as inputs thereto. Step <b>620</b> involves using the second keystream to encrypt the second data so as to produce the second encrypted data (e.g., ciphertext). Upon completing step <b>620</b>, method <b>600</b> ends or other processing is performed (e.g., repeat steps <b>618</b>-<b>620</b> for a next block of message data), as shown by step <b>628</b>.

If a duplex framework is employed [<b>616</b>: NO], then steps <b>622</b>-<b>626</b> are performed. Prior to discussing steps <b>622</b>-<b>626</b>, it should be understood that in the duplex context the first encrypted data (e.g., ciphertext) is produced in previous step <b>614</b> by: combining the first keystream with authentication data to generate the second combination bits; producing a second keystream by performing the permutation function ƒ using the second combination bits as inputs thereto; and combining the second keystream with the message body data so as to produce the first encrypted data (e.g., ciphertext). The second keystream is also used in step <b>622</b> to produce the third combination bits. The third combination bits are input into the permutation function ƒ, as shown by step <b>624</b>. As a result of performing the permutation function ƒ, a third keystream is produced. At least a portion of the third keystream is used as an authentication tag.

All of the apparatus, methods and algorithms disclosed and claimed herein can be made and executed without undue experimentation in light of the present disclosure. While the invention has been described in terms of preferred embodiments, it will be apparent to those of skill in the art that variations may be applied to the apparatus, methods and sequence of steps of the method without departing from the concept, spirit and scope of the invention. More specifically, it will be apparent that certain components may be added to, combined with, or substituted for the components described herein while the same or similar results would be achieved. All such similar substitutes and modifications apparent to those skilled in the art are deemed to be within the spirit, scope and concept of the invention as defined.